Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae0048816e45e32d…

MALICIOUS

PDF

224.5 KB
MD5: 98cffe0ff7ae1ac22bf3c614915e84ee SHA-1: 0ad8817b69cdeae9e7a126e51e98768250b783f7 SHA-256: ae0048816e45e32da73f0ccb4185a0bb670fc956f1bbfc3daff70a82f6dad38e
84 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution T1059.001 PowerShell

The PDF file contains embedded JavaScript and is flagged for exploiting CVE-2010-0188, a vulnerability in Adobe Reader related to LibTIFF XFA image handling. This indicates the file is designed to execute arbitrary code upon opening. No document body text was available for analysis, but the critical heuristic firing strongly suggests a client-side exploit.

Heuristics 4

  • Adobe Reader LibTIFF XFA image exploit — CVE-2010-0188 critical CVE likely CVE_2010_0188
    PDF contains XFA image data with an inline crafted TIFF payload and shellcode/delivery markers. This is the data-bound variant of the CVE-2010-0188 Adobe Reader LibTIFF/XFA exploit shape.
  • Embedded file low PDF_EMBEDDED
    PDF embeds a file attachment — could carry an executable or another weaponised document as a nested payload
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules. (matched inside decoded stream)
  • XFA form low PDF_XFA
    PDF uses XML Forms Architecture — can contain script logic (matched inside decoded stream)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_file_obj0001.bin
10cc41d851989f20c09532d48c93f582992b29a807c66e7f6b3411f11e489421		 pdf-embedded-file PDF EmbeddedFile object 1 at offset 0x54 412582 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.